Security of decoy-state quantum key distribution with inexactly controlled source 
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The existing theory of decoy-state quantum cryptography assumes the counting rates of the same 
state from different sources to be the same, given whatever channel. This is correct if the intensity 
of each individual pulse is controlled exactly. We show by an explicit example that the assumption 
is in general incorrect if the source is inexactly controlled and the error pattern is known to Eve. 
We then further develop the theory of decoy-state method so that it is unconditionally secure given 
whatever error pattern provided that the error is not too large and the bounds of errors are known. 
Our result is not only limitted to the coherent states. It allpies to all source states satisfying Eq.(17). 

PACS numbers: 03.67.Dd, 42.81. Gs, 03.67.Hk 



Introduction. — Most of the existing set-ups of quan- 
tum key distribution (QKD)[l|, Q, H, 0, [B| use imperfect 
single-photon source. Such an implementation in princi- 
ple suffers from the photon- numb er-sp litting attack 
The decoy-state method [1, [II Eli [U HI] and some other 
methods 

0,1 13, EH can be used for unconditionally se- 
cure QKD even Alice only uses an imperfect source [6 
The separate theoretical results of ILM-GLLP 
shows that a secure final key can be distilled even though 
an imperfect source is used in the protocol, if one knows 
the lower bound of the fraction of those raw bits gener- 
ated by single-photon pulses from Alice. The decoy-state 
method is to verify such a bound faithfully and efficiently. 
Recently, a number of experiments on decoy-state QKD 
have been done [H, 17 1. However, the existing decoy- 
state theory assumes the perfect control of light intensity. 
This is an impossible task for any real set-up in practice. 
Here we study the decoy-state method with intensity er- 
rors and we conclude that after revising, the decoy-state 
method is still secure and efficient. Our result immedi- 
ately applies to all existing experimental results. 
Existing theory . — Given a class of N x pulses, after Alice 
sends them out to Bob, if Bob observes n x counts at his 
side, the counting rate for pulses in this class is 



n x /N x . 



(1) 



Proposition 1: If class X is divided into I subclasses 
and any pulse in X belongs to only one subclass and 
the fraction of pulses in each subclasses are arj> Oi " * " , a U 
then the counting rate of class X is Sx — J2k=o a k s k 
and s k is the counting rate of the kih subclass. 

Proposition 2. The counting rate of pulses from 
class y must be equal to that of class y' if: 1) each class 
contains sufficiently large number of pulses; 2) pulses of 
each class are independent and identical; 3) the density 
operator of a pulse from class y is equal to that of class 



y' , 4) pulses of y and y' are randomly mixed. 

Alice has 3 different sources Yq , , Y^i which can pro- 
duce states of po = |0}(0|, p^, p^i only. Suppose 



p^ = J2 a k\k){k\; P ^ =J2a' k \k)(k\ (2) 

fc=0 fc=0 

and we request the following constraints for all n > 2: 



^fc > <H 
a k a 2 



(3) 



Here the states are subscribed by p and p! because the 
diagonal states are actually determined by the intensity 
p or p! . For example, a coherent state of intensity q with 
phase randomization is 



fc=0 



^ p k e M 



M 



\k)(k\. 



(4) 



If Alice uses coherent states of intensity 0, p, and p' for 
source Yq , Y^ and Y^ in the protocol, the state parame- 

ters are a k = a k , , a k = — . 

We regard the pulses from each source as a class, 
i.e. class Yq for intensity 0, class Y^ for intensity p' and 
class Y^i for intensity p! . We shall also call the pulses in 
class Yp, Y/j,/ the decoy pulses and the signal pulses, re- 
spectively for simplicity. We regard those decoy or signal 
pulses containing k photons as (sub-)class y k or y' k . We 
also use the term sub-source for sub-class. 

Proposition 1 leads to the following relation, 



5 M = a kS k = a s + ojsi + A 



(5) 



and A = a fc s fc, is the total counting rate of all 

decoy pulses, s k is the counting rate of pulses in class y k . 
Also, we have 



"SV " a 'k s 'k 



(0) 



k=0 



2 



and S^i , si are the counting rates of all signal pulses and 
class y' k , respectively [lOj . In the protocol, Alice chooses 
each source randomly in producing each pulse for Bob. If 
each source always produces the assumed state exactly, 
pulses from sub-sources yo,y' ,Yo are randomly mixed, 
and so are classes y k ,y k - According to Proposition 2, 

«o = s' = S , s k = s' k (7) 

where So is the counting rate of class Yq. Also, using the 
assumed condition in Eq.©, we can simplify Eq.© as 

S M > = y~] a' k s k > a' Q s + a[si + —A. (8) 

— Q>2 

According to the definition of counting rate, So ; S^ , Sy 
can be observed directly in the protocol. Since there are 
only two unknown variables (si, A) for two constraints 
in Eq.© and Eq.©, the lower bound value of s± can be 
verified by solving these joint constraints. 

a' 2 (S^ - a s ) - a 2 (Sy - a' s ) 

s% > ; -, . (,yj 

a 2 a\ — a 1 a 2 

Given this, one can calculate the final key rate bv[Bl [llT| 

R = A' 1 [1-H(t 1 )]-H(t) (10) 

where = is the fraction of single-photon counts 
among the raw bits due to signal pulses and t\ , t are the 
QBER for single-photon pulses and the QBER for all 
signal pulses. This is the result the decoy-state method 
with whatever diagonal source-state, including the co- 
herent state, thermal state, heralded single-photon state, 
and so on with the condition of Eq. © and exactly con- 
trolled source. 

The consequence of correlated intensity error. — The ex- 
isting theory assumes that the parameters for state of 
each individual decoy pulses and signal pulses keep to be 
constant. In practice, these parameters cannot be con- 
stant for all pulses [l3. l20j ]. If the parameter errors are 
independent, then we can [l9[ use the averaged state for 
each source to verify the lower bound of si by Eq.©. 
However, the issue becomes more complicated in the 
most general situation when there are correlated inten- 
sity errors. As shown explicitly below, in such a case, the 
average-state method fails and we have to consider the 
instantaneous intensity of each individual pulses. 

There can be correlated intensity errors which are not 
known to Alice and Bob but is known to Eve. (This 
situation is more realistic if one uses the decoy-state plug- 
and-play protocol [2lj], where Eve. can actually prepare 
the error pattern). Consider a specific example. In the 
whole protocol, the pulses are divided into M blocks. 
Each block contains N/M pulses and N = Nq + + 
N^, where No, N^, N^ are number of pulses from source 
Yq,Y^,Y^i , N is the total number of pulses. The state 



of each individual pulse from source Yq,Y^ are always 
controlled exactly. But there are errors for the state of 
pulses from source Y^ (decoy pulse). Say, in half of those 
M blocks, state for every decoy pulse is actually vacuum 
(we name any of such blocks as block -Do)- In the other 
half of blocks, the intensity of each decoy pulse is twice 
of the assumed value, i.e., 2/i, and /i is the value for 
the assumed intensity that Alice wants to use for each 
decoy pulse. We name these blocks as block D 2 . Note 
that either block Dq or block D 2 consists of three classes, 
YqjY^jY^i . Eve. knows such type of error pattern but 
Alice does not know it. We shall assume [i = 0.2 and // = 
0.6 in the protocol. Actually, by watching the averaged 
photon number of each block, Eve can know exactly the 
intensity of decoy pulses in each block, i.e., or 2\i = 0.4, 
provided that N/M is not so small. 

Here is Eve's scheme using time-dependent chan- 
nel: she blocks all pulses from block Dq, and she pro- 
duces a linear channel of transmittance rj e to attenuate 
each pulse from block D 2 . Straightly, the actual counting 
rate for the sub-source yi is si = 2 2 e ^-iJ* — Ve and the 
actual counting rate for sub-source y' x is 

, lr/efi'e-f*' 

s i = o / -u' = W2. 11 
2 /i'e i 1 

Obviously, s\ ^ s^. Similarly, we can also show that 
Sk s 'k- This shows, given the correlated error which is 
known to Eve, Eve can treat the pulses from sub-sources 
yk and y' k differently ! Proposition 2 of the existing decoy- 
state theory can not be used anymore. Given the corre- 
lated intensity error, pulses from sub-source y k and y' k 
are actually not randomly mixed: in some blocks, the 
number of A;— photon decoy pulses are larger than that of 
other blocks. 

If one disregards the fact that Proposition 2 does not 
hold now and go ahead to use Eq.@ with the averaged 
state for the decoy pulse, the protocol will be insecure be- 
cause the calculated value of the single-photon counting 
rate by the existing theory will be larger than the true 
value. For simplicity, we assume So = 0. Given the Eve's 
scheme above, Alice and Bob will find 

Sn = » 0.2?7 e ; = pa 0.3?7 e 

(12) 

If we go ahead to assume s k = s' k and blindly use Eq.©, 
the counting rate of sub-source y[ can be obtained by 
replacing a 2 ; with the 0.4 /c e _0 4 /fc!/2 there. The result 
for the counting rate of single-photon pulses by Eq. © is 

si = s[ > 2.65336% (13) 

which is larger than the real value rj e /2 as shown Eq. lfTTj) . 
This means, the value of counting rate for single-photon 
from signal pulses verified by the protocol would be larger 
than the true value and hence the protocol is insecure. 



3 



A more realistic case[8j that in certain blocks, inten- 
sities of all pulses are a bit higher and in other blocks 
intensities of all pulses are a bit lower than the assumed 
values, it is also found that si ^ s[ therefore existing 
decoy state theory cannot be used blindly. 
Remark on proposition 2. — The above study has clearly 
shown that, if there are correlated intensity errors of light 
intensity, Proposition 2 cannot be blindly used because 
here y± and y[ are not randomly mixed and the result is 
insecure given the time-dependent Eve's channel. 

Our solution. — In the actual protocol, each pulse sent 
from Alice is randomly chosen from one of 3 sources 
{ Y , Y M , Yy } with probability p , p M , (p +p^+ fy = 
1 ) . For simplicity, we assume that every pulse in class Y 
is exactly in vacuum state. But each single shot of pulse 
in classes , Y^ can be in a state slightly different from 
the expected one. We assume at time i Alice actually 
produces 



= y^Qfcj|fc)(fc| 



Pn'i = ^a' kl \k)(k\ 



(14) 



(15) 



instead of or /y as defined in Eq.([2]), where the pa- 
rameters of each |fe)(A;| are constant. If Alice uses co- 
herent states, the time-dependent parameters an, a' ki are 
determined by the time-dependent intensities by aki = 

^Ti — ' a 'ki ~ — ~> ana - M»( or pQ i s the instantaneous 
intensity of the ?'th pulse ( decoy signal pulse). Lets first 
consider a virtual protocol, Protocol 1: At each time 
i in sending a pulse to Bob, Alice produces a two-pulse 
(pulse A and pulse B) bipartite state 

Pi = Po I z ) (z 1 <8> 1 0) (0 1 +p M I zi ) (z 1 1 (g) /y + jy I z 2 ) (z 2 1 ® /y 

(16) 

Here the first subspace is for pulse A and the second 
subspace is for pulse B; i runs from 1 to N, the to- 
tal number of pulses transmitted to Bob. States 
are orthogonal to each other for different x (x = 0, 1,2). 
Alice keeps pulse A and sends out pulse B to Bob. Af- 
ter Bob completes the detection, Alice measures pulse 
A. The outcome of |^o)> or \z 2 ) of pulse A cor- 
responds to class Yo,Y^ or Y^j for pulse B. Asymp- 
totically, the number of pulses in theses classes should 
be N = Po N, Nf, = Pfl N, Ay = p^N. We use 
notation a k , a k for lower bound and upper bound of 
{oki\i = 0, 1 • • • N}, a' k L , a' k u for lower bound and upper 
bound of {a^|z = 0, 1, • • ■ N}. Also, we need 



-,/L 



,/L 



> 



> 1 



(17) 



for all k > 2. In the protocol, Alice could have known 
the exact photon number in any pulse before sending it 
to Bob. We define those pulses containing k photons as 



class yfc, e.g., all the single-photon pulses make of class 
2/1. For clarity, we also define set {Ik} (k = Q, 1, 2 ■ • •): for 
the iih pulse (i from 1 to N) , if the pulse contains k pho- 
tons, then i £ Ik- Since Alice could have known the pho- 
ton number in each pulse, any i must belong to only one 
Ik- Asymptotically, there should be Nk = Yli (Pn a ki + 
Pn'a' ki ) pulses (elements) in class (set) jjk (h) for any 
k > and there are N = J2t=i(Po+aoiP^+a' oi p^) pulses 
(elements ) in class (set) yo (Iq). Also, each individual 
pulse can only belong to one class from {§k\k = 0, 1, • • •}. 
Most generally, we assume the instantaneous transmit- 
tance of the z'th pulse to be rji (i from 1 to N), which 
should be either or 1. If the pulse causes no count 
at Bob's side, the instantaneous counting rate for that 
pulse is 0, otherwise it is 1. Given any photon number 
state |fc)(fc|, it can be from both class Y^ and class Y^i . 
Asymptotically, the numbers of counts caused by decoy 
pulses (pulses from class Y^), signal pulses and pulses in 
class Yq are 



= '^Pfj.aoidi + 2J ^ P^Qkidj 



(18) 



iei 



k=l i£l h 



^P^a'oidi + ^^Pn'a'kidi (19) 



ieio 



and 



n(Y ) = J2 



k=l i£l k 



Pa 



iek. 



Po +P^a 0l +Pfj,>a 



(20) 



respectively, where di is defined as 



V< 



P^am+p^a'^+pQ 



if * e l (21) 



di = 



— ; if i e h, k>l (22) 



Pfj,aki +Pfi'a k , 

The values of ry ry and n(Yo) can be directly observed 
in the protocol, therefore are regarded as known parame- 
ters. Based on Eq. (|20| . we have the following inequality: 



y^^P^aoidj 



< 



p^n(Y ) _ v 



ieio 



Po 



P^SqN, (23) 



Pv'a'oidi > 



p^a' Q L n(Y 0l _ ,, 



Po 



Pn'ctfSoN (24) 



and So = , the counting rate of class Yo, which is 
observed in the protocol itself. Given bounded values for 
parameters {aki, a' ki }, we have 



n„ < P^SqN + P ^ d > + a k (Yl d ^ ( 25 ) 



lEl 



k=2 iel 
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TABLE I: Secure key rate (R) vs different values of intensity 
error upper bound (5m) using the experimental data in the 
case of 50 km [17]. The experiment lasts for 1481.2 seconds 
with the repetition rate 4 MHz. We have observed S^i = 
3.817 x 1(T 4 ,S M = 1.548 x lO" 4 ,^ = 2.609 x 10~ 5 and the 
quantum bit error rates (QBER) for signal states and decoy 
states are 4.247%, 8.379% respectively. 



8m 


5% 


4% 


3% 


2% 


1% 





R (Hz) 


70.8 


84.3 


97.6 


110.7 


123.6 


136.3 



and 



ieh 



oo 

k=2 iel k 



(26) 

Using the assumed conditions given in Eq. (fl7jl we can 
solve the above simultaneous constraints and obtain 



1 



■ \ ■ j -j, a> 2 Sfj. — 0,2 S^i + ag L a^ So — a^a' 2 L Sq 
N ^ 1 ~ a' L aU - a\ L a% 

ieh 



(27) 



where 5 M = = j*-, Sy = jfj. The fraction of 

single-photon counts among those counts caused by sig- 
nal pulses is — '' , which is lower bounded by 



, a'^(a' 2 L S^, - a^S^ + a' Q L a^So - a^a' 2 L S ) . . 

and the fraction of single-photon counts of decoy pulses 
is lower bounded by 

For coherent states, if the intensity is bounded by 
[fi L , [i u ] for decoy pulses and \p! L , fj,' u ] for signal pulses 
then 



(^) fe e -^/fc!, af = (^ x ) fc e ^' X /fc! (30) 



with X — L.U and fc = 1, 2. Therefore, one can calculate 
the final key rate by Eq. lfTUl) now, if the bound values of 
intensity errors are known. The asymptotic result using 
the experimental data of QKD distance of 50 kilometers 
calculated by our formula is listed in table I. 

The results above are for the virtual protocol where 
Alice uses the bipartite state of Eq. (fT7j)) . Obviously Alice 
can choose to measure all A-pulses of each bipartite state 
in the very beginning and the virtual protocol is reduced 
to the normal protocol in practice, where the bipartite 
state is not necessary. 

Application in the Plug-and-Play protocol. — As shown by 
Gisin et al[2l|, combining with the decoy-state method, 
the plug-and-play protocol can be unconditionally secure. 
There, Alice receives strong pulses from Bob and she 



needs to guarantee the exact intensity of the pulse send- 
ing to Bob. It is not difficult to monitor the intensity, 
but difficult to control the intensity. Our theory here can 
help to save the difficult feed-back intensity control: Al- 
ice monitors the intensities, discards those pulses whose 
intensity error is too large, and then use our theory with 
the known bound bound of intensity errors. 
Concluding remark: In summary, we have shown the 
the unconditional security of decoy-state method given 
what-ever error patern of the source, provided that the 
parameters diagonal state of the source satisfy Eq.(17) 
and the bound values of each parameters in the state is 
known. Our result here applies to whatever distribution 
of source state that satisfies Eq.(17). Our result also an- 
swers clearly the often asked question "What happens if 
the state of Laser beam is not exactly in the assumed 
distribution ?" . Here we don't need exact information 
about the source state, we only need the bound values 
for parameters a\^a 2 .\'^a! 2 and Eq.(17). 
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